Check out the ansibleguy.haproxy_waf_coraza Example for a more detailed Coraza-WAF config-example!
You might want to combine the actual WAF-functionality with basic Security-checks and TLS-Fingerprinting!
waf: # Role: ansibleguy.haproxy_waf_coraza
apps:
- name: 'default'
- name: 'default_block'
block: true
# apis
- name: 'app1'
block: true
rules:
vars: ...
rule_changes: ...
- name: 'app2'
haproxy:
waf:
coraza:
enable: true
default_app: 'default'
frontends:
fe_web:
bind: ['[::]:80 v4v6']
routes:
be_test1:
domains: ['test1.ansibleguy.net']
be_test2:
domains: ['test2.ansibleguy.net']
be_app1:
domains: ['app1.ansibleguy.net']
be_app2:
domains: ['app2.ansibleguy.net']
default_backend: 'be_fallback'
backends:
be_test1:
servers: ...
be_test2:
servers: ...
security:
coraza_app: 'default_block'
be_app1:
servers: ...
be_app2:
servers: ...
be_fallback:
lines: 'http-request redirect code 302 location https://github.com/ansibleguy'root@test-ag-haproxy-waf:/# cat /etc/haproxy/haproxy.cfg
> # Ansible managed: Do NOT edit this file manually!
> # ansibleguy.infra_haproxy
>
> global
> daemon
> user haproxy
> group haproxy
>
> tune.ssl.capture-buffer-size 96
>
> log /dev/log local0
> log /dev/log local1 notice
> chroot /var/lib/haproxy
> stats socket /run/haproxy/admin.sock mode 660 level admin
> stats timeout 30s
> ca-base /etc/ssl/certs
> crt-base /etc/ssl/private
> ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
> ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
> ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
>
> defaults
> log global
> mode http
> option httplog
> option dontlognull
> timeout connect 5000
> timeout client 50000
> timeout server 50000
> errorfile 400 /etc/haproxy/errors/400.http
> errorfile 403 /etc/haproxy/errors/403.http
> errorfile 408 /etc/haproxy/errors/408.http
> errorfile 500 /etc/haproxy/errors/500.http
> errorfile 502 /etc/haproxy/errors/502.http
> errorfile 503 /etc/haproxy/errors/503.http
> errorfile 504 /etc/haproxy/errors/504.http
root@test-ag-haproxy-waf:/# cat /etc/haproxy/waf-coraza.cfg
> # Ansible managed
> # ansibleguy.haproxy_waf_coraza
>
> backend coraza-waf-spoa
> mode tcp
> server coraza-waf 127.0.0.1:9000 check
root@test-ag-haproxy-waf:/# cat waf-coraza-spoe.cfg
> # Ansible managed
> # ansibleguy.haproxy_waf_coraza
>
> [coraza]
> spoe-agent coraza-agent
> messages coraza-req
> groups coraza-req
> option var-prefix coraza
> option set-on-error error
> timeout hello 2s
> timeout idle 2m
> timeout processing 500ms
> use-backend coraza-waf-spoa
> log global
>
> spoe-message coraza-req
> args app=var(txn.waf_app) src-ip=src src-port=src_port dst-ip=dst dst-port=dst_port method=method path=path query=query version=req.ver headers=req.hdrs body=req.body
>
> spoe-group coraza-req
> messages coraza-req
root@test-ag-haproxy-waf:/# cat /etc/haproxy/conf.d/frontend.cfg
> # Ansible managed: Do NOT edit this file manually!
> # ansibleguy.infra_haproxy
>
> frontend fe_web
> mode http
> bind [::]:80 v4v6
>
> # Security headers
> http-response add-header Strict-Transport-Security "max-age=16000000; includeSubDomains; preload;" if !{ res.hdr(Strict-Transport-Security) -m found }
> http-response add-header X-Frame-Options "SAMEORIGIN" if !{ res.hdr(X-Frame-Options) -m found }
> http-response add-header X-Content-Type-Options "nosniff" if !{ res.hdr(X-Content-Type-Options) -m found }
> http-response add-header X-Permitted-Cross-Domain-Policies "none" if !{ res.hdr(X-Permitted-Cross-Domain-Policies) -m found }
> http-response add-header X-XSS-Protection "1; mode=block" if !{ res.hdr(X-XSS-Protection) -m found }
>
> http-request capture req.fhdr(User-Agent) len 200
>
> # BACKEND be_test1
> acl be_test1_filter_domains req.hdr(host) -m str -i test1.ansibleguy.net
> use_backend be_test1 if be_test1_filter_domains
>
> # BACKEND be_test2
> acl be_test2_filter_domains req.hdr(host) -m str -i test2.ansibleguy.net
> use_backend be_test2 if be_test2_filter_domains
>
> http-request set-var(txn.waf_app) str(default_block) if be_test2_filter_domains
>
> # BACKEND be_app1
> acl be_app1_filter_domains req.hdr(host) -m str -i app1.ansibleguy.net
> use_backend be_app1 if be_app1_filter_domains
>
> http-request set-var(txn.waf_app) str(be_app1) if be_app1_filter_domains
>
> # BACKEND be_app2
> acl be_app2_filter_domains req.hdr(host) -m str -i app2.ansibleguy.net
> use_backend be_app2 if be_app2_filter_domains
>
> http-request set-var(txn.waf_app) str(be_app2) if be_app2_filter_domains
>
> # Coraza WAF
> http-request set-var(txn.waf_app) str(default) if !{ var(txn.waf_app) -m found }
>
> filter spoe engine coraza config /etc/haproxy/waf-coraza-spoe.cfg
> http-request send-spoe-group coraza coraza-req
> http-request capture var(txn.waf_app) len 50
> http-request capture var(txn.coraza.id) len 16
> http-request capture var(txn.coraza.error) len 1
> http-request capture var(txn.coraza.action) len 8
> http-request deny status 403 default-errorfiles if { var(txn.coraza.action) -m str deny }
> http-response deny status 403 default-errorfiles if { var(txn.coraza.action) -m str deny }
> http-request silent-drop if { var(txn.coraza.action) -m str drop }
> http-response silent-drop if { var(txn.coraza.action) -m str drop }
root@test-ag-haproxy-waf:/# systemctl status haproxy.service
> * haproxy.service - HAProxy Load Balancer
> Loaded: loaded (/lib/systemd/system/haproxy.service; enabled; preset: enabled)
> Drop-In: /etc/systemd/system/haproxy.service.d
> `-override.conf
> Active: active (running) since Sat 2024-05-04 16:24:54 UTC; 4min 11s ago
> Docs: man:haproxy(1)
> file:/usr/share/doc/haproxy/configuration.txt.gz
> https://www.haproxy.com/documentation/haproxy-configuration-manual/latest/
> https://github.com/ansibleguy/infra_haproxy
> Process: 4574 ExecStartPre=/usr/sbin/haproxy -c -f $CONFIG -f /etc/haproxy/conf.d/ -f /etc/haproxy/waf-coraza.cfg (code=exited, status=0/SUCCESS)
> Process: 4635 ExecReload=/usr/sbin/haproxy -c -f $CONFIG -f /etc/haproxy/conf.d/ -f /etc/haproxy/waf-coraza.cfg (code=exited, status=0/SUCCESS)
> Process: 4637 ExecReload=/bin/kill -USR2 $MAINPID (code=exited, status=0/SUCCESS)
> Main PID: 4576 (haproxy)
> Status: "Ready."
> Tasks: 7 (limit: 1783)
> Memory: 132.2M
> CPU: 297ms
> CGroup: /system.slice/haproxy.service
> |-4576 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/conf.d/ -p /run/haproxy.pid -S /run/haproxy-master.sock
> `-4639 /usr/sbin/haproxy -sf 4578 -x sockpair@4 -Ws -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/conf.d/ -p /run/haproxy.pid -S /run/haproxy-master.sock
root@test-ag-haproxy-waf:/# systemctl status coraza-spoa.service
> ● coraza-spoa.service - Coraza WAF SPOA Daemon
> Loaded: loaded (/etc/systemd/system/coraza-spoa.service; enabled; preset: enabled)
> Drop-In: /etc/systemd/system/coraza-spoa.service.d
> └─override.conf
> Active: active (running) since Fri 2024-12-27 19:45:29 CET; 1h 12min ago
> Docs: https://www.coraza.io
> https://github.com/corazawaf/coraza-spoa
> https://github.com/corazawaf/coraza
> https://coraza.io/docs/seclang/directives/
> https://github.com/ansibleguy/haproxy_waf_coraza
> https://docs.o-x-l.com/waf/coraza.html
> Main PID: 3878168 (coraza-spoa)
> Tasks: 10 (limit: 4531)
> Memory: 11.7M
> CPU: 4.099s
> CGroup: /system.slice/coraza-spoa.service
> └─3878168 /usr/bin/coraza-spoa -config=/etc/coraza-spoa/spoa.yml